🇮🇩
securejdprop
2026-10-20 00:40:25
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/vpatch-env-access.
Hacking
Web App Attack
🇬🇧
consul.to
2026-10-20 00:37:09
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇮
sibahota
2026-10-19 23:11:32
(2 days ago)
38.146.25.208 - - [19/Oct/2026:23:11:29 +0000] stockworld.co "GET /sendgrid.env HTTP/1.1" 403 37 0.0 ...
show more
38.146.25.208 - - [19/Oct/2026:23:11:29 +0000] stockworld.co "GET /sendgrid.env HTTP/1.1" 403 37 0.000 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" - - - "http://stockworld.co"
...
show less
Web App Attack
Brute-Force
2026-10-19 16:11:25
(2 days ago)
harvesting of secret and configuration files (.env, .git/config, .aws/credentials, SSH keys); e.g. / ...
show more
harvesting of secret and configuration files (.env, .git/config, .aws/credentials, SSH keys); e.g. /.env.development, /.env.dev, /.env.prod. Requests blocked by our WAF (automated report).
show less
Web App Attack
Hacking
2026-10-19 16:06:34
(2 days ago)
(mod_security) mod_security triggered on hostname [redacted] 38.146.25.208 (US/United States/-)
SQL Injection
🇺🇸
TPI-Abuse
2026-10-19 15:33:13
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 38.146.25.208 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 38.146.25.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 11:33:08.911530 2026] [security2:error] [pid 411:tid 411] [client 38.146.25.208:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eddysgroup.com"] [uri "/.env"] [unique_id "atY4NKtrd24I_kjVBWt10wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-19 15:27:43
(2 days ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇩🇪
IVski.com
2026-10-19 15:20:45
(2 days ago)
IVski WAF | Sensitive file probe detected - looking for .env
Hacking
Brute-Force
Web App Attack
🇨🇦
zXero
2026-10-19 11:23:46
(2 days ago)
Fail2Ban automatic report - jail: web-exploit
Brute-Force
SSH
DDoS Attack
🇨🇱
Denis Chavez
2026-10-19 11:07:35
(2 days ago)
Fail2Ban detected malicious activity on Nginx
Brute-Force
SSH
Web App Attack
🇳🇱
Alt255
2026-10-19 03:24:38
(3 days ago)
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 38. ...
show more
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 38.146.25.208 - - \[19/Oct/2026:05:24:30 +0200\] "GET /.env HTTP/1.1" 301 551 "-" "Mozilla/5.0 \(X11\; Linux x86_64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-19 02:45:25
(3 days ago)
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-27al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 38.146.25.208 - - [19/Oct/2026:04:45:04 +0200] "GET /.env HTTP/1.1" 301 578 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-19 02:33:25
(3 days ago)
(mod_security) mod_security (id:949110) triggered by 38.146.25.208 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:949110) triggered by 38.146.25.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 22:33:20.748048 2026] [security2:error] [pid 6231:tid 6231] [client 38.146.25.208:55188] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "freedrm.org"] [uri "/.env"] [unique_id "atWBcDRcbv8B9rMWyDmdIQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lnklnx
2026-10-19 02:24:47
(3 days ago)
www.lnklnx.com:80 38.146.25.208 - - [18/Oct/2026:21:24:45 -0500] "GET /.env HTTP/1.1" 301 546 "-" "M ...
show more
www.lnklnx.com:80 38.146.25.208 - - [18/Oct/2026:21:24:45 -0500] "GET /.env HTTP/1.1" 301 546 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"
...
show less
Web App Attack
🇺🇸
H24
2026-10-19 02:02:39
(3 days ago)
/.env /.env~ /.env.bak
Web App Attack